CVE-2022-22757

MEDIUM

Firefox < 97.0 - Remote Browser Control via WebDriver Host Header Spoofing

Title source: llm
STIX 2.1

Description

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. <br>*This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.*. This vulnerability affects Firefox < 97.

References (2)

Core 2

Scores

CVSS v3 6.5
EPSS 0.0023
EPSS Percentile 13.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-345 CWE-346
Status published
Products (1)
mozilla/firefox < 97.0
Published Dec 22, 2022
Tracked Since Feb 18, 2026